Tcpdump: Traffic between localhost:[src-port:dst-port]

You may have a problem with different interfaces. By default tcpdump only listens on the first ethernet interface it finds. If you add "-i any" it will listen on every interface.

As someone has mentioned already, you will end up capturing all the traffic to a particular ip address, regardless of the dns name you want. You can reduce the amount of data you capture by restricting the filter further. You could add a port and specify a particular remote host or network.

# tcpdump host 12.34.56.78 and port 80 and net 78.65.43.21/24 

You may find that tcpflow is more useful to you. It will dump each side of a TCP connection into a separate file. You can either use it with the same filter you'd use with tcpdump, or you can load a pcap file in. To save a pcap file, run:

# tcpdump -s 0 -w /tmp/dump.pcap -i any host 12.34.56.78 and port 80

tcpdump prints complete packets. "Garbage" you see are actually TCP package headers.

you can certainly massage the output with i.e. a perl script, but why not use tshark, the textual version of wireshark instead?

tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

it takes the same arguments as tcpdump (same library) but since its an analyzer it can do deep packet inspection so you can refine your filters even more, i.e.

tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -R'http.request.method == "GET" || http.request.method == "HEAD"'